3.4 Low
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N
4.3 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:M/Au:N/C:P/I:N/A:N
0.975 High
EPSS
Percentile
100.0%
Network Security Services (NSS) is a set of libraries designed to support
the cross-platform development of security-enabled client and server
applications. Netscape Portable Runtime (NSPR) provides platform
independence for non-GUI operating system facilities.
This update adds support for the TLS Fallback Signaling Cipher Suite Value
(TLS_FALLBACK_SCSV), which can be used to prevent protocol downgrade
attacks against applications which re-connect using a lower SSL/TLS
protocol version when the initial connection indicating the highest
supported protocol version fails.
This can prevent a forceful downgrade of the communication to SSL 3.0.
The SSL 3.0 protocol was found to be vulnerable to the padding oracle
attack when using block cipher suites in cipher block chaining (CBC) mode.
This issue is identified as CVE-2014-3566, and also known under the alias
POODLE. This SSL 3.0 protocol flaw will not be addressed in a future
update; it is recommended that users configure their applications to
require at least TLS protocol version 1.0 for secure communication.
For additional information about this flaw, see the Knowledgebase article
at https://access.redhat.com/articles/1232123
The nss, nss-util, and nss-softokn packages have been upgraded to upstream
version 3.16.2.3, which provides a number of bug fixes and enhancements
over the previous version, and adds the support for Mozilla Firefox 31.3.
(BZ#1158159, BZ#1165003, BZ#1165525)
Users of nss, nss-util, and nss-softokn are advised to upgrade to these
updated packages, which contain a backported patch to mitigate the
CVE-2014-3566 issue, fix these bugs, and add these enhancements. After
installing this update, applications using NSS or NSPR must be restarted
for this update to take effect.
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
RedHat | 6 | ppc | nss-pkcs11-devel | < 3.16.2.3-3.el6_6 | nss-pkcs11-devel-3.16.2.3-3.el6_6.ppc.rpm |
RedHat | 7 | s390x | nss | < 3.16.2.3-2.el7_0 | nss-3.16.2.3-2.el7_0.s390x.rpm |
RedHat | 5 | x86_64 | nss | < 3.16.2.3-1.el5_11 | nss-3.16.2.3-1.el5_11.x86_64.rpm |
RedHat | 7 | ppc64 | nss | < 3.16.2.3-2.el7_0 | nss-3.16.2.3-2.el7_0.ppc64.rpm |
RedHat | 5 | ppc | nss | < 3.16.2.3-1.el5_11 | nss-3.16.2.3-1.el5_11.ppc.rpm |
RedHat | 7 | s390 | nss | < 3.16.2.3-2.el7_0 | nss-3.16.2.3-2.el7_0.s390.rpm |
RedHat | 7 | ppc | nss-debuginfo | < 3.16.2.3-2.el7_0 | nss-debuginfo-3.16.2.3-2.el7_0.ppc.rpm |
RedHat | 6 | ppc | nss-debuginfo | < 3.16.2.3-3.el6_6 | nss-debuginfo-3.16.2.3-3.el6_6.ppc.rpm |
RedHat | 7 | i686 | nss-softokn-devel | < 3.16.2.3-1.el7_0 | nss-softokn-devel-3.16.2.3-1.el7_0.i686.rpm |
RedHat | 5 | s390 | nss-pkcs11-devel | < 3.16.2.3-1.el5_11 | nss-pkcs11-devel-3.16.2.3-1.el5_11.s390.rpm |
3.4 Low
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N
4.3 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:M/Au:N/C:P/I:N/A:N
0.975 High
EPSS
Percentile
100.0%